@pidgeon-ai/cli 1.37.0 → 1.38.0

package/dist/{chunk-RWZQSI67.js → chunk-ZDJG3Z7B.js}

@@ -2027,7 +2027,7 @@ function sleep(ms, signal) {
   });
 }
 
-// ../id/dist/chunk-EAXZTLYY.js
+// ../id/dist/chunk-C5J6V6N2.js
 import { createHash } from "crypto";
 import { chmod, mkdir, readFile, readdir, writeFile } from "fs/promises";
 import { homedir } from "os";
@@ -2562,6 +2562,10 @@ var IdClient = class {
   grant(input) {
     return this.call("POST", "/grants", input);
   }
+  /** Every token Sign in with Pidgeon issued `name`, taken back; its card and grants stand. */
+  revokeSignIns(name) {
+    return this.call("DELETE", `/agents/${encodeURIComponent(name)}/sign-ins`);
+  }
   revokeGrant(id) {
     return this.call("DELETE", `/grants/${encodeURIComponent(id)}`);
   }
@@ -2633,7 +2637,21 @@ async function fetchCard(agent, fetcher = fetch, postHost = (domain) => `https:/
   }
   return body.jws;
 }
-async function signInWithPidgeon(identity, input) {
+function signInWithPidgeon(identity, input) {
+  return signIn(
+    identity,
+    input,
+    async ({ tokenEndpoint, exchange, headers, agent }) => signRequest(identity, {
+      method: "POST",
+      url: tokenEndpoint,
+      headers,
+      body: exchange,
+      agent,
+      grants: input.grant ? [input.grant] : void 0
+    })
+  );
+}
+async function signIn(identity, input, authenticate) {
   const fetcher = input.fetch ?? fetch;
   const agent = input.agent.trim().toLowerCase();
   const site = await siteMetadata(input.site, fetcher);
@@ -2649,21 +2667,15 @@ async function signInWithPidgeon(identity, input) {
     grant_type: TOKEN_EXCHANGE,
     subject_token: card,
     subject_token_type: TOKEN_TYPE_JWT,
-    audience: site.client_id
+    audience: site.client_id,
+    ...input.delegation ? { requested_token_type: TOKEN_TYPE_JWT } : {}
   });
   const headers = { "content-type": "application/x-www-form-urlencoded" };
   const issued = await fetcher(tokenEndpoint, {
     method: "POST",
     headers: {
       ...headers,
-      ...await signRequest(identity, {
-        method: "POST",
-        url: tokenEndpoint,
-        headers,
-        body: exchange,
-        agent,
-        grants: input.grant ? [input.grant] : void 0
-      })
+      ...await authenticate({ tokenEndpoint, exchange, headers, agent, site })
     },
     body: exchange
   });
@@ -2719,7 +2731,9 @@ var HELP = `pidgeon id \u2014 a signed identity for your agents, on your own dom
   grant <name>           Grant <name> what it may do, as the domain
                            --scope bookings.change --label "manage bookings"
                            --subject customer:42  --audience delta.com  --days 30
+                           --grantor maria@example.com   ask a person instead
   revoke-grant <id>      Take a grant back now
+  revoke-sign-ins <name> End every token <name> signed in with; its card and grants stand
   sign-in <site>         Sign in to a site as an agent   --as <name>  --grant <jws>
 
   --domain <domain>      Which domain, when this machine holds more than one
@@ -2895,14 +2909,23 @@ Or add them by hand:` : "Add these records at your DNS provider:",
         }
         const days = flags.get("days");
         const audience = flags.get("audience");
+        const grantor = flags.get("grantor");
         const grant = await client2(await which()).grant({
           agent: name,
           scope: { name: scope, label },
           subject: { type, id: idParts.join(":") },
           ...typeof audience === "string" ? { audience } : {},
+          ...typeof grantor === "string" ? { grantor: { email: grantor } } : {},
           ...typeof days === "string" ? { expires_at: new Date(Date.now() + Number(days) * 864e5).toISOString() } : {}
         });
         if (json2) return JSON.stringify(grant, null, 2);
+        if (grant.consent_url) {
+          return [
+            `Asked ${typeof grantor === "string" ? grantor : "them"} to let ${grant.agent} ${grant.scope.label} for ${grant.subject.type} ${grant.subject.id}.`,
+            `Send them this link; nothing is allowed until they answer it: ${grant.consent_url}`,
+            `Grant ${grant.id}. \`pidgeon id revoke-grant ${grant.id}\` withdraws the request.`
+          ].join("\n");
+        }
         return [
           `${grant.agent} may ${grant.scope.label} for ${grant.subject.type} ${grant.subject.id}${grant.audience ? ` at ${grant.audience}` : ""}, until ${grant.expires_at}.`,
           `Grant ${grant.id}. The agent carries it as Post-Grant; --json prints the JWS.`
@@ -2915,6 +2938,14 @@ Or add them by hand:` : "Add these records at your DNS provider:",
         if (json2) return JSON.stringify(revoked, null, 2);
         return `Grant ${revoked.id} is revoked. The next check of it fails.`;
       }
+      case "revoke-sign-ins": {
+        const name = rest[0]?.trim().toLowerCase();
+        if (!name)
+          throw new UsageError("Name the agent: `pidgeon id revoke-sign-ins support-agent`.");
+        const done = await client2(await which()).revokeSignIns(name);
+        if (json2) return JSON.stringify(done, null, 2);
+        return `${done.address}: ${done.revoked} token${done.revoked === 1 ? "" : "s"} taken back. Its card and grants stand.`;
+      }
       case "sign-in": {
         const site = rest[0];
         const name = flags.get("as");
@@ -3147,4 +3178,4 @@ export {
   find,
   run
 };
-//# sourceMappingURL=chunk-RWZQSI67.js.map
+//# sourceMappingURL=chunk-ZDJG3Z7B.js.map